# Enable secure boot and full disk encryption for x86 device types **URL:** \ **Category:** Feature Requests\ **Tags:** balenacloud, balenaos, done\ **Created:** [January 16, 2023, 10:54am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329 "2023-01-16T10:54:44Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [January 16, 2023, 10:54am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/1 "2023-01-16T10:54:44Z")
No description provided. ---
**Author:** ![anonymizeduser](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/anonymizeduser/32/10188_2.png) [@anonymizeduser](https://forums.balena.io/u/anonymizeduser)\ **Post date:** [January 26, 2023, 3:08pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/2 "2023-01-26T15:08:14Z")
1000x YES ---
**Author:** ![anonymizeduser](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/anonymizeduser/32/10188_2.png) [@anonymizeduser](https://forums.balena.io/u/anonymizeduser)\ **Post date:** [January 27, 2023, 3:49pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/3 "2023-01-27T15:49:27Z")
I raise you! This would literally allow us to deploy about 100 x more stuff on balena where it makes sense. ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [January 27, 2023, 7:02pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/4 "2023-01-27T19:02:06Z")
Joseph Kogut: It’s good to see such positive feedback for this feature. 🙂 I’ve been working on augmenting our QEMU worker we use to run automated test suites for balenaOS to be capable of running our flasher image, as well as enabling secure boot in a virtualized environment using OVMF firmware. This will allow us to validate secure boot enabled images in our automated test suite, including ensuring that secure boot and full-disk encryption are properly enabled, host OS upgrades and fallback capability work, and all other currently tested OS functionality remains operational. ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [January 28, 2023, 12:34pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/5 "2023-01-28T12:34:37Z")
Alex Gonzalez: To complement the above, the feature has made good progress and we are finishing up the automation testing and fixing issues that arise from that tests. We are also finalizing the secure infrastructure that is needed to sign the release artifacts. It’s one of the priorities of the OS team at the moment so you can expect to see progress soon enough. ---
**Author:** ![anonymizeduser](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/anonymizeduser/32/10188_2.png) [@anonymizeduser](https://forums.balena.io/u/anonymizeduser)\ **Post date:** [March 15, 2023, 8:52pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/6 "2023-03-15T20:52:12Z")
Has there been any progress toward releasing this feature in the previous 2 months? Any status update is appreciated. ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [March 16, 2023, 11:42am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/7 "2023-03-16T11:42:00Z")
Alex Gonzalez: Thanks for the message - the secure boot and full disk encryption feature for x86\_64 is currently being tested. We did a last minute change to use db hashes instead of db certificates to avoid issues with certificates expiration, and also to support key updates on hostOS updates invalidating artifacts signed with previous singing material. In summary, the signing infrastructure is ready, the final db hashing change is being tested, and the automated tests are just about to be ready. We are finalizing the feature documentation too. ---
**Author:** ![anonymizeduser](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/anonymizeduser/32/10188_2.png) [@anonymizeduser](https://forums.balena.io/u/anonymizeduser)\ **Post date:** [March 20, 2023, 7:26am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/8 "2023-03-20T07:26:44Z")
That sounds great! Can you already say something about the deployment. Does it has to be a new installation or will it be possible to migrate a device to an encrypted disk? ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [March 20, 2023, 9:18am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/9 "2023-03-20T09:18:50Z")
Alex Gonzalez: Initially it has to be a new installation as the secure boot and full disk encryption are used together and partitions need to be encrypted. In the near future we are working on a `migrator` tool that will allow for remote installations/migrations and will offer the migration path to secure boot and disk encryption (see [Provide tool to onboard (migrate) devices already deployed in the field · Balena Feature Requests](https://roadmap.balena.io/posts/2/provide-tool-to-onboard-migrate-devices-already-deployed-in-the-field)) ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [April 17, 2023, 2:39pm UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/10 "2023-04-17T14:39:11Z")
Joseph Kogut: Quick update, two of our three automated OS test suites have passed with secure boot and full-disk encryption enabled. Those two suites test OS-specific functionality, such as secure boot specific tests (including verifying that partitions are encrypted, and signature/hash checks work as expected), filesystem checks, configuration, engine, and networking, as well as integration tests with the cloud platform. The third suite tests host OS updates (HUP), and hasn’t seen an automated run yet as we don’t have a signed production image deployed to update from. We’re working on deploying signed images by default, which will also enable testing HUP. ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [May 18, 2023, 9:43am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/11 "2023-05-18T09:43:51Z")
Alex Gonzalez: Some good news, the `2.114.21` release for the `Generic x86_64 (GPT)` device type in production was our first signed release. We are very close to the official feature announcement, and although we don’t yet recommend to use secure boot and full disk encryption on your production fleets you can definitely use it in the lab and test your applications on it. The team is working on validating the key management processes, and finishing off documentation, and once those are out of the way the feature will be ready to go. ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [June 2, 2023, 10:57am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/12 "2023-06-02T10:57:40Z")
Alex Gonzalez: This feature is now available in production, please take a look at the feature release announcement in [https://blog.balena.io/balenaOS-secure-boot-and-disk-encryption-for-x86-64/](https://blog.balena.io/balenaOS-secure-boot-and-disk-encryption-for-x86-64/). ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [June 2, 2023, 10:58am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/13 "2023-06-02T10:58:47Z")
Alex Gonzalez set the status to **Completed** This feature is now available in production and the release announcement is at [https://blog.balena.io/balenaOS-secure-boot-and-disk-encryption-for-x86-64/](https://blog.balena.io/balenaOS-secure-boot-and-disk-encryption-for-x86-64/). ---
**Author:** ![anonymizeduser](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/anonymizeduser/32/10188_2.png) [@anonymizeduser](https://forums.balena.io/u/anonymizeduser)\ **Post date:** [June 5, 2023, 7:06am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/14 "2023-06-05T07:06:09Z")
That’s fantastic news, thanks for the bringing this feature in so quickly! At the moment, we are using UP-Boards in our fleet. As far as I can tell, the are very close to a generic x86 hardware and activating the new secure-boot/encryption feature should be easy(, isn’t it? What’s the difference anyway?). So is it also the near road map, can we expect it the next months or so? ---
**Author:** ![system](https://global.discourse-cdn.com/balena/original/2X/6/60e5c11e1222480d38bea45d7ab9ea57bbe86d53.png) [@system](https://forums.balena.io/u/system)\ **Post date:** [June 8, 2023, 10:46am UTC](https://forums.balena.io/t/enable-secure-boot-and-full-disk-encryption-for-x86-device-types/373329/15 "2023-06-08T10:46:39Z")
Alex Gonzalez: Thanks for your message. We are working on bringing secure boot and disk encryption support to our other x86 based device types. In particular the up-board repository uses the vendor’s [BSP layer](https://github.com/AAEONAEU-SW/meta-up-board) instead of the the generic support provided by Poky which is used for the `Generic x86_64` device types. The vendor BSP provides extra support for the hardware which is not available in the generic images.